WIREDGOV

techUK welcomes and shares the government's ambition to ensure the UK is better protected against ransomware and recognise the serious threat it poses to organisations and the wider economy. The cyber threat landscape and particularly the ransomware ecosystem is evolving to become increasingly complex and professionalised, and it targets all parts of the UK and global economies.

However, techUK and its members expressed concern that any guidance or framework would need to be carefully designed to avoid further burdening victims of ransomware attacks and prevent any unintended consequences.

In our response, we outlined how a full implementation of the proposals could have the following impact on the sector:

• Potential duplication of efforts and compliance if these proposals are not aligned to the Cyber Resilience and Security Bill, among other government strategies.
• Placing an undue burden on the victim of an attack. Members feel strongly that victims needs support not punishment.
• Banning payments could inadvertently push ransomware transactions underground, reduce visibility into cyber criminal and/or shifting attacks to other sectors outside UK CNI and Public Sector, such as Manufacturing which contribute significantly to the UK economy or further down the supply chain.
• A blanket approach could create disproportionate challenges for particular groups that may lack the resources or expertise to comply.

Some high-level points and recommendations include:

• techUK and members disagreed with that the government should implement a targeted ban on ransomware payments on CNI and public sector, highlighting the points above as key challenges to it's implementation.
• Non-compliance of a ban could lead to criminalising a victim of a crime. techUK and members find any such initiative counterproductive to the government's own resilience agenda which fails to address the root cause.
• The current voluntary ransomware incident reporting regime should continue to be used with a more structured approach which ensures organisations see the value in reporting, rather than perceiving it as an additional regulatory burden.
• The government should create a 'one stop shop' for reporting of an incident and outline the clear next steps a business should take if they are the victim of an attack. This would help to incentivise incident reporting. 
• The government should share anonymised threat intelligence using data gathered from incident reporting, this should be shared with organisations to support their understanding of the threat landscape and further incentives compliance with reporting regimes.

Read our full response here.